Explanation of Sign-on As Examples - Analytics Database - Teradata Vantage

Security Administration
Deployment
VantageCloud
VantageCore
Edition
Enterprise
IntelliFlex
VMware
Product
Analytics Database
Teradata Vantage
Release Number
17.20
Published
June 2022
Language
English (United States)
Last Update
2024-04-05
dita:mapPath
hjo1628096075471.ditamap
dita:ditavalPath
qkf1628213546010.ditaval
dita:id
zuy1472246340572
lifecycle
latest
Product Category
Teradata Vantage™
Syntax Element Description
mech_name Specifies the authentication mechanism.
For Teradata authorization:
  • KRB5
  • SPNEGO
  • LDAP
For directory authorization:
  • KRB5
  • SPNEGO
user_credentials Specifies the username and password for the logon, and must conform to the following rules:
  • For Teradata authorization, the username is a network or directory username for which there is a matching database user.
  • For directory authorization, the username is a network username for which there is a matching directory user.
  • The password is always a network password.

Valid formats for user credentials:

In the .logdata statement for KRB5 and SPNEGO:

diruser@@dirpassword

Sign-On As using Kerberos authentication (SPNEGO mechanism) is usable only from Windows clients.
In the .logdata statement for LDAP:
  • authcid= diruser password= dirpassword
  • diruser@@dirpassword
  • diruser password= dirpassword

In a .logon statement for KRB 5 and SPNEGO:

domain_username,domain_password

In a .logon statement for LDAP:

dir_username,dirpassword

Ensuring Correct Interpretation of UPNs

For the logon diruser,dirpassword, the user specification can be “a@b” or a/b” or “a\b”. Set LdapCredentialIsUPN to interpret the user specification. See LdapCredentialIsUPN.
  • If the LdapCredentialIsUPN property is absent or set to yes (the default), the system treats the user specification as a UPN, which must conform to the rules of IETF 1964.
    When LdapCredentialIsUPN is set to yes, the UPN must appear in the logon as: “a\@b” or “a\/b” or “a\\b”, where the added backslash (\) character informs the system how to handle the following character.
  • If the LdapCredentialIsUPN property is set to no, the system disregards the special characters and considers the user specification to be an Authcid.
authorization_qualifier Required if the user is authorized by the directory (AuthorizationSupported=yes) and this is true:
  • The directory user is mapped to multiple user or profile objects

Directory user mapped to multiple database users:

If the directory user is mapped to more than one database user, specify the user with the database privileges needed for the session in the form:

user= database_username

The database username can be either an individual database user or EXTUSER.
Directory user mapped to multiple profiles:
  • If a directory user is mapped to more than one profile, specify profile=profile_name in the .logdata statement to identify the session profile.
  • If the directory user is mapped to one or more database users and also to a profile, the session defers to the separately mapped profile instead of the profile belonging to the mapped database user.
Directory offers multiple realms (LDAP authentication only):

Specify the realm as it appears in the directory, normally the fully qualified DNS name of the directory, for example:

realm=directory_FQDNSName

The system processes realm information as follows:
  • If the directory does not offer a realm contained in the .logdata statement, the logon fails.
  • If the .logdata statement specifies a realm when it is needed, the logon succeeds if it is a valid realm specification.
tdpid Required. The tdpid identifies the Teradata Vantage system, or host group to which the logon, if successful, connects.
, , If the logon specifies an account, and the directory username and directory password appear in the .logdata statement, the , , must precede the account specification, with these exceptions:
  • If the user credentials appear in the .logon statement, only a single comma is required.
  • If the .logon does not specify an account, no commas are required.
"account" Optional. The account string specification must be enclosed in double quotation marks.

For information on accounts, see Teradata Vantage™ - Database Administration, B035-1093.